Questions tagged [netflow]
For question about the NetFlow protocol.
53
questions
24
votes
4
answers
68k
views
What is the difference between netFlow and sFlow?
How is sFlow different from netFlow, and how is each supported by different vendors ?
- 1,687
12
votes
1
answer
2k
views
What is the "NDE" interface on a Cisco 6500?
I have a pair of Cisco 6509 routers, which are monitored via SNMP (with Observium, to be accurate).
Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a ...
- 1,687
9
votes
3
answers
974
views
ASA Netflow support
Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with ...
- 799
9
votes
1
answer
3k
views
How does NAT Stitching work?
While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching.
I understand Flow Stitching which join same type of inbound and outbound connection.
But can't find anything ...
- 603
7
votes
1
answer
3k
views
How to get ipfix working with openvswitch? [closed]
I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/
According to the ovs-vsctl manpage I need to add a new entry into the config-database, ...
6
votes
5
answers
912
views
Can netflow be left on all the time?
One of my colleagues and I have gotten into a debate about netflow. He's an old Cisco hand and I've recently joined the cisco ops team after working on Juniper for a few years. The debate is whether ...
- 63
5
votes
1
answer
361
views
Mechanisn for performing bandwidth accounting on Cisco routers
We're about to purchase a pair of Cisco 7201s for our edge routers, and some Juniper EX4200s for core. And I'm looking for implement bandwidth accounting for our hosted servers on this hardware (most ...
- 1,478
5
votes
0
answers
297
views
Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling rate?
Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling? For example, input sampling rate for xe-0/0/1 is one of 100 and input sampling rate for xe-0/0/2 interface is one of 500. I ...
- 1,177
4
votes
1
answer
290
views
Set of features to characterize DDoS from Netflow data [closed]
I am currently working on a DDoS detection problem from Netflow data from an ISP’s perspective. Very large datasets are available to me for analysis. Though I have done considerable amount of work, ...
- 141
3
votes
1
answer
2k
views
NetFlow configuration on Catalyst 4500-X
I have a problem with config NetFlow on 4500-X switch.
This is NetFlow config
flow record NFArecord
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
...
- 255
3
votes
2
answers
915
views
NetFlow-working one direction only
Cisco 3850/IP Base/IOS XE 3.7.2
I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one ...
- 181
3
votes
2
answers
462
views
Can multiple netflow exporters use same collector port name?
As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple ...
- 451
2
votes
2
answers
433
views
Sampled Netflow
i have configured netflow in my router but my router is overheaded.
So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
- 21
2
votes
1
answer
2k
views
Not receiving netflow v9, v5 works - Juniper SRX
We have an ELK Stack running that gathers data and processes it to the point where end users can visualize the data.
Right now we're dealing with Syslogs and Netflow, but are experiencing some issues ...
- 21
2
votes
3
answers
3k
views
What is a common setting for NetFlow Active Flow Timeout?
What is a common/best practice value for 'active flow time-out' for flow generation from packets.
With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src ...
- 121
2
votes
1
answer
196
views
Is there ever a scenario where there would be a 0 length response to an ECHO?
I'm attempting to utilize the flow probe argus to determine "node liveliness"/reachability.
I am currently working on handling ICMP status, but would like to derive a method to determine if a ping "...
- 135
2
votes
2
answers
4k
views
Netflow vs sampled netflow
I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times.
...
- 180
2
votes
2
answers
420
views
Why is Wireshark unhappy with my Netflow packet sequence numbers?
I wrote a Netflow v10 (IPFIX) traffic generator. It spoofs Source IP addresses to pretend to be coming from multiple sites, and has fake users it sends reports about. The idea is very similar to ...
- 135
2
votes
1
answer
262
views
Netflow and Nfsen related question
We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here.
If you look at first Bytes(%) column 67.2 G(80.6) so it's in GB what does this means? ...
- 4,351
2
votes
1
answer
104
views
What is Netflow Scope field?
I was looking at RFC3954, RFC7011 and some Cisco docs - however I can't find the answer for what is the Scope field? What information does it carry?
- 33
2
votes
1
answer
877
views
What field tells me the bytes in IPFIX?
In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX?
I'm shipping IPFIX data with softflowd and I'm getting these fields:
destinationIPv4Address
...
- 459
2
votes
1
answer
370
views
The router exports IPFIX data and templates from two different source id
I configure Netflow Flexible use IPFIX protocol on a Cisco router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (source id = 0) and template-sets with ...
- 123
2
votes
1
answer
133
views
Cisco top-talker data
I have enabled top-talkers ingress/egress
ip flow-top-talkers
top 10
sort-by bytes
cache-timeout 1
I wanted to confirm a couple things with the output below
1.) When I see a (K), I assume its ...
- 23
2
votes
0
answers
100
views
NDE for QoS Flows on SUP720-3C?
I've setup per user Layer 2 policing on a pair of Cat6k with SUP720-3C to rate-limit wireless guest users. This is working fine and the flow table is populated as expected (with L2 QoS flows).
Now my ...
1
vote
1
answer
568
views
sflow top talker support
I have nexus 9300 switch and i have configured sflow and i want to find out top-talker IP from command line but i am not seeing any command.
I have Cisco ASR1k and i have configured netflow and i ...
- 4,351
1
vote
1
answer
114
views
Netflow V9 field Id range
I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128.
I got the above information from
(79) - NetFlow v9 has a ...
- 123
1
vote
1
answer
84
views
netflow in unknown on my switch
I am using the 3750G catalyst switch and I want to configure netflow but when I put the first command it appears that netflow is unknown:
invalid input detected when i'm using netflow
- 11
1
vote
1
answer
2k
views
Netflow on Cisco Catalyst 2960X is not sending data to PRTG
I am using 2 Cisco Catalyst 2960X as a stacked switch and I am trying to set up Netflow on them with PRTG as network monitor but it seems that I'm stuck somewhere, below are the config I'm using:
...
- 13
1
vote
1
answer
467
views
Configure jflow v5 get error: interface-name: 'xxx': Must be a services interface
friends:
When I configure the jflow v5 on my MX-480:
=====
admin@USA-MX-RE0# show forwarding-options sampling
instance {
MONITOR-FLOW {
input {
rate 1000;
}
...
- 1,747
1
vote
1
answer
338
views
What is the expected states of a Cisco Netflow entry if it were collected during different stages of a TCP 3-way handshake?
The standard TCP handshake goes:
1. SYN (client->server)
2. SYN+ACK (server->client)
3. ACK (client->server)
The NetFlow flags are ORed together and comprise of:
URG ACK ...
- 111
1
vote
1
answer
114
views
Where does Netflow get Written to?
I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows ...
- 13
1
vote
1
answer
596
views
cisco flow vs ip flow
Using a 2900 series router and I encounter the following issue:
hostname#show flow monitor
Flow Monitor TESTFLOW:
Description: User defined
Flow Record: TESTFLOW
Flow Exporter: ...
- 221
1
vote
1
answer
1k
views
My ASA has decided to stop sending NetFlow traffic. Is there a way to fix this short of restarting?
I have been running NetFlow successfully on all of my ASAs for the past few months. Recently, one of my ASA failover pairs has decided to stop sending netflow packets. Is there a command to restart ...
- 705
1
vote
1
answer
532
views
How is start and end time of a flow encoded in Netflow (v9)?
I'm trying to convert AWS VPC Flow Logs into Netflow v9. Each VPC Flow Log record has start and end timestamps that I'd like to encode in a Netflow data record. Looking at the Netflow v9 spec, there ...
- 113
1
vote
1
answer
2k
views
Cisco netflow with nfsen/nfdump
We have Cisco ASR1000 Router and it has following configuration:
flow record netflow-record
match transport tcp destination-port
match transport tcp source-port
match transport udp ...
- 4,351
1
vote
1
answer
90
views
sniffing through my company's lan [closed]
I'm in charge of the network in my company and i have to check the visited websites.We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.DPI (as is it implemented in ...
1
vote
0
answers
60
views
Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]
I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
- 11
1
vote
0
answers
2k
views
Huawei: Configuring netstream
I'm trying to configure NETSTREAM, but I'm a little confused. Following this tutorials: Configuring NetStream export and Huawei: NetStream Configuration.
I'm configuring netstream on Huawei Ne20e
...
1
vote
1
answer
2k
views
Flexible NetFlow Cisco - define input and output?
I am trying to understand the definition of "input" and "output" traffic to an interface.
Below is extracted from Flexible NetFlow Documentation in Cisco 3850 ->
If you apply a flow monitor in the ...
- 529
1
vote
1
answer
198
views
NetFlow working for physical/sub interfaces only?
As far as I know, NetFlow can collect data from physical interfaces and its subinterfaces, right?
Not from loopback, VLAN, tunnel or any virtual interface.
- 383
1
vote
1
answer
3k
views
NetFlow v9 on Cisco Catalyst 3560 not working
my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work.
let me show you the config:
flow exporter NETFLOW-EXPORTER
destination 10.10.10.12
source Vlan100
transport udp ...
- 203
0
votes
1
answer
555
views
PRTG - NetFlow v9 on Cisco ASA 5520 not working [closed]
We have a PRTG Probe 192.168.4.4 in our office's Domain Controller, and we are trying to configure NetFlow on our leased Cisco ASA 5520 ver 8.2(5)
We have done the following on the Cisco:
conf t
...
- 23
0
votes
2
answers
1k
views
Go Back N protocol
I am trying to understand the working of Go-Back N using this website:-
http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/
Here, suppose we are sending frames 1,2,3,4,5,6 (window size 4) and in ...
- 421
0
votes
1
answer
257
views
Best practices for IP Flow monitoring [closed]
Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source ...
- 201
0
votes
2
answers
86
views
Network report integrated with Active Directory or Users
How can i take network report of bandwidth consumption that integrated with AD or users?
I have ASA 5506 and configured netflow 9 with PRTG,
I can see the source IP and Destination IPs, Is there any ...
- 313
0
votes
1
answer
775
views
What does limit a MTU set for an interface? [closed]
The maximum MTU I can set is between 9000 an 10,000 for a Ethernet interface.
I have the following message for high values
ifconfig eth0 mtu 10000
SIOCSIFMTU: Invalid argument
What is the origin ...
- 105
0
votes
1
answer
177
views
resolving IP address to FQDN effectively [closed]
We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has ...
- 82
0
votes
1
answer
316
views
Best practice for configuring sampler rate on Nexus 7000 for Netflow
Is there a best practice for configuring the sampler rate for interfaces that will be sending netflow data. I have tested on our Nexus 7000 with the mode 1 out-of 1000 on interfaces that are seeing ...
- 371
0
votes
1
answer
180
views
Best practices to build network flow monitoring
Recently I'm investigating the solutions for ip flow monitoring, and come across a lot of pages talking about different solutions and trade-offs between netflow, sflow, IPFIX, etc. In short, netflow/...
0
votes
0
answers
131
views
read traffic/bandwidth usage by protocol
I need to analyze the traffic of a Fortigate Firewall in my program.
Currently, I can read the overall traffic using SNMP.
The problem is that I need to analyze the type of traffic (HTTP, video ...
